Data Processing Agreement (DPA)

1. Parties

Processor: Evosolve Korlátolt Felelősségű Társaság (Evosolve Kft.), trading as Auro AI (the "Processor", "we").

Controller: the business registered to the Auro AI customer account (the "Controller", "Customer").

2. Subject, duration, nature, purpose

Subject: processing of personal data on behalf of the Controller when it uses the Auro AI software service (the "Service").

Duration: from account creation until the return and deletion duties in section 10 have been completed after the contract ends.

Nature: automated electronic processing on the infrastructure of Hetzner Online GmbH in Germany, and with the further processors listed in Annex III.

Purpose: providing the Auro AI functions (finance and bookkeeping support, CRM, HR, communications inbox, AI-supported functions) to the Controller.

3. Data subjects and data types

Data subjects: the Controller’s employees and contractors; its customers and contacts; its suppliers; visitors using an embedded Auro widget on the Controller’s website; job applicants where the recruitment module is used.

Types of personal data:

• Identification and contact data: name, e-mail address, phone number, address, internal ID.
• Employment and payroll data (only if the HR module is used): tax identification number, social security (TAJ) number, bank account number, date of birth, home address, family data for tax allowances.
• Communication content: chat and e-mail messages, attachments, messages passing through the inbox.
• Financial data: invoices, payments, bank statement lines.
• Usage data: logged actions, IP address, browser identifier, timestamps.

We do not process special-category data (GDPR Art. 9) by default. Sick leave is recorded only as a period and the label "sick leave", without diagnosis. The Controller must not upload special-category or criminal-offence data unless agreed with us in writing beforehand.

4. Processor obligations

1. Documented instructions. We process personal data only on the Controller’s documented instructions: (a) this agreement, (b) the Controller’s settings in the dashboard, (c) individual instructions sent to [email protected]. We do not process for our own purposes, we do not sell the data and we do not use it to train AI models. If Union or Member State law requires a transfer to a third country we inform the Controller first unless the law forbids this. If we think an instruction infringes the law we tell the Controller without delay.
2. Confidentiality. Persons with access to personal data are bound by confidentiality (by contract or by law).
3. Security (Art. 32). We apply the technical and organisational measures in Annex II.
4. Sub-processors. Under section 6, on the same data-protection obligations; we remain fully liable for them.
5. Assistance. Taking account of the nature of the processing we help the Controller to answer data-subject requests (access, rectification, erasure, restriction, portability, objection) and to meet its obligations under Arts. 32-36 (security, breach notification, impact assessment, prior consultation). We normally respond to a request from the Controller within 7 working days, depending on its scope. If a data subject contacts us we forward the request to the Controller and do not answer on the merits in its place.
6. Breach. Under section 8.
7. Deletion and return. Under section 10.
8. Evidence and audit. We make available the information needed to show compliance with Art. 28 and allow audits under section 9.

5. Controller obligations

• The Controller is responsible for the legal basis of the processing (Art. 6), for obtaining data-subject consent where needed, and for informing data subjects under Arts. 13-14.
• The Controller is responsible for its instructions being lawful.
• The Controller keeps its account credentials safe and uses the two-factor authentication available.
• Where the Controller adds its own AI key, it decides whether to accept processing outside the EU (see section 7) and bears the legal consequences.

6. Sub-processors

6.1. The Controller gives general written authorisation to engage sub-processors. The current list is at auroai.eu/subprocessors.php (Annex III summarises it).

6.2. We notify the Controller by e-mail at least 30 days before a new or replacement sub-processor starts. The Controller may object on reasonable data-protection grounds in that period. If we cannot accommodate the objection the Controller may terminate the affected service and we refund the fee for any paid but unused period pro rata.

6.3. We impose on each sub-processor by contract the same data-protection obligations as bind us under this agreement, and we remain fully liable to the Controller for its performance.

7. Transfers outside the EEA

7.1. Primary data is stored in the European Union (Hetzner, Germany). AI functions use by default Mistral AI SAS (France), which operates in the EU, so by default no personal data is transferred outside the EEA.

7.2. Exception: the Customer’s own AI key. If the Controller adds its own AI provider key and that provider processes data outside the EEA, the platform uses the key only after the Controller’s explicit, recorded acceptance naming that provider and endpoint. The Controller can withdraw the acceptance at any time. In that case the Controller instructs us that the data concerned be processed by the chosen provider, which is then a sub-processor under Annex III. The basis for the transfer to a third country is the provider’s certification under the EU-US Data Privacy Framework and/or the Commission’s Standard Contractual Clauses ((EU) 2021/914).

7.3. Some other sub-processors (for example Cloudflare for network services, or Google, Microsoft or Meta services that the Controller connects) may have a parent company outside the EEA; the safeguard used is shown on the list and available on request.

8. Personal data breach

We notify the Controller of a personal data breach affecting its data without undue delay and at the latest within 48 hours of becoming aware of it, by e-mail to its registered address. The notice states: the nature of the breach; the categories and approximate number of data subjects and records, as far as known; the likely consequences; and the measures taken or proposed. Where not all information is available yet we supply it in stages. This supports the Controller under Arts. 33-34 (notifying the supervisory authority, NAIH, within 72 hours of becoming aware is the Controller’s task). The status page shows operational status.

9. Audits

Once a year, at the Controller’s request, we provide a description of our security measures and complete its written audit questionnaire. An on-site or deeper audit can be requested on 30 days’ written notice, at the Controller’s cost, with reasonable confidentiality and scheduling limits; an audit following a documented breach is not subject to the yearly limit. For third-party infrastructure (for example Hetzner) we meet audit requests through their certificates and reports where they do not allow direct audits.

10. Return and deletion

When the service contract ends the Controller may, within 30 days, request a complete export of its data in a machine-readable format (for example CSV or JSON). After 30 days, or earlier at the Controller’s request, we delete the data from our active systems; from backups it is deleted as they rotate (within 90 days at most). Data that law requires us to keep (in particular accounting documents, 8 years, Accounting Act section 169) is kept with restricted access, for that purpose only, until the retention period ends.

11. Liability

Liability for breach is governed by section 14 of the Terms. This agreement does not limit a data subject’s right to compensation under Art. 82 GDPR. Between the parties, damage is borne as set out in Art. 82(5) GDPR.

12. Governing law

This agreement is governed by Hungarian law and the GDPR. The courts named in section 19 of the Terms have jurisdiction. The Hungarian text is binding; the English version is a courtesy translation.

Annex I - Description of processing

Annex II - Security measures (GDPR Art. 32)

This describes only what we actually do. We develop the measures in line with risk and will not lower the level of protection.

• Encryption in transit: public endpoints are served over HTTPS (TLS); HSTS is enabled.
• Protection of stored data: access tokens and keys stored for third-party services are encrypted at application level (AES-256-GCM); selected sensitive personal-data fields (for example the HR module’s tax ID, TAJ number and bank account data, and conversation content) are also stored in encrypted columns. The encryption key is held outside the database in the server configuration; key rotation is supported.
• Access control: role-based permissions in the application; two-factor authentication (TOTP) and passkeys are available for owner accounts; the session cookie is protected (Secure, HttpOnly, SameSite); request rate limiting; each customer account’s data is logically separated and tied to the account ID.
• Network: Cloudflare provides DNS, CDN and DDoS protection in front of the public interfaces.
• Logging: security-relevant actions (sign-in, permission and data changes, deletion) are logged.
• Backups: a full logical backup of each database is made daily; after verification (gzip integrity, completeness) 14 daily and 8 weekly copies are kept on the hosting, outside the public web directory with owner-only permissions. In addition, the daily backup is copied every day to a different server (Hetzner Cloud, Nuremberg, Germany): that server pulls the copy with a read-only, restricted key and keeps it for 14 days. Restoring from backup was tested (22 October 2026). Backups are not encrypted at rest; they are protected by access restriction.
• Retention and deletion: automated retention routines run daily and delete expired data; a deletion tool serves data-subject erasure requests and records the fact of deletion in an audit trail that contains no personal data.
• Personnel: persons with access to personal data are bound to confidentiality; access follows job role.
• Secure development: changes are preceded by automated checks (static and consistency checks) before they reach production.
• Sub-processor governance: a public list; processing outside the EEA only under section 7, with suitable safeguards.
• Incident handling: the 48-hour notification commitment in section 8; operational status on the status page.

Annex III - Sub-processors (summary)

The complete, current list: auroai.eu/subprocessors.php.

The NAV (Hungarian tax authority) is not our sub-processor: we transmit data to NAV systems within the Customer’s legal reporting duty, on the Customer’s instruction and in its name.